TO: 


Of: 


ICO. 


Information Commissioner’s Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


House Guard UK Limited 


2 Westover Road, Bournemouth, Dorset, BH1 2BY 


The Information Commissioner (“Commissioner”) has decided to issue 
House Guard UK Limited (“House Guard”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty 
is being issued because of a serious contravention of regulation 21 of 
the Privacy and Electronic Communications (EC Directive) Regulations 
2003 (“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


House Guard, whose registered office is given above (companies house 
registration number:11023674), is the person stated in this notice to 
have used a public electronic communications service for the purpose 
of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 
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Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 
Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


“(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 
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(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at any 
time, and 
(b) where such notification is withdrawn, the caller shall not make such 


calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The Telephone Preference 
Service Limited (“TPS”) is a limited company set up to carry out this 
role on behalf of the Commissioner. Businesses who wish to carry out 
direct marketing by telephone can subscribe to the TPS for a fee and 


receive from them monthly a list of numbers on that register. 


Section 122(5) of the DPA18 defines direct marketing as “the 
communication (by whatever means) of any advertising material which 
is directed to particular individuals”. This definition also applies for the 
purposes of PECR (see regulation 2(2) PECR & Schedule 19 paragraphs 
430 & 432(6) DPA18). 
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Under section 55A (1) of the DPA (as amended by PECR 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 


2015) the Commissioner may serve a person with a monetary penalty 


notice if the Commissioner is satisfied that - 


“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 


2003 by the person, and 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 


electronic communications sector. PECR were amended for the purpose 
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of giving effect to Directive 2009/136/EC which amended and 


strengthened the 2002 provisions. The Commissioner approaches the 


PECR regulations so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background tọ the case 


House Guard is an organisation that specialise in masonry protection 
solutions. These consist of spray-on insulation that is applied to the 


external of buildings. 


Between 8 May 2018 and 31 December 2018, the ICO received 91 
complaints about unsolicited direct marketing calls made by House 
Guard. Of those, 58 complaints were made to the TPS, with a further 
33 made direct to the Commissioner. All of these complaints were 


made by individual subscribers who were registered with the TPS. 


The following are examples of the complaints received by the ICO: 


e “The usual guff about our cavity wall insulation being 
inadequate and needing to be replaced. As soon as I said 
we're ex-directory and on the TPS, and the potential fine for 
junk calls, he hung up. I didn’t get a chance to ask about 
GDPR.” 


e “I was busy doing my work and expecting a call from a client 


when the nuisance call was a rude and annoying interruption. 
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When I mentioned that I would report her, she asked me to 


go ahead..” 


e “Asked about cavity wall insulation that we had done 5 years 
ago (no work has been done) then hung up when I asked for 


the company name..” 


e “Cavity wall insulation. Claimed that they had been asked by 
the Government to contact people who had installed cavity 


insulation in the past 10 years.” 


e “Cavity Wall insulation. When I mentioned being TPS 
Registered and them not cleansing their data etc He told me 


he had found a loophole and he could call anyone.” 


On 31 October 2018, the Commissioner wrote to House Guard to 
explain that she could issue civil monetary penalties up to £500,000 
for PECR breaches. The letter informed House Guard that the 
Commissioner and the TPS had received complaints from individual 
subscribers in relation to unsolicited calls. House Guard was asked a 


number of questions about its compliance with PECR. 


The Commissioner received a response from House Guard explaining 
that it purchased data from several third party data providers. It had 
used that data to call individual subscribers to market its products and 
services. It had not screened the data against the TPS since its 
purchase as they were assured by its providers that it was “opted in 
and/or TPS cleansed” and “ready for marketing purposes by 


telephone”. 


House Guard further explained in correspondence that it conducted no 
due diligence when the data was purchased before using it to make 
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marketing calls other than to screen it against their internal 
suppression list. It was unable to ascertain from where the data was 
originally sourced or the actual basis of the consent relied on. House 
Guard believed that the data had been opted in for generic third party 
home improvement companies and believed that this was sufficient. It 


had no contract in place with its providers. 


The Commissioner's investigation revealed that of 669,966 connected 
calls made by House Guard within the period of 8 May 2018 and 31 
December 2018, 371,958 of these were made to numbers which were 


registered with the TPS at least 28 days before receiving a call. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by House Guard and, if so, 


whether the conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that House Guard contravened regulation 21 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


Between 8 May 2018 and 31 December 2018, House Guard used a 
public telecommunications service for the purpose of making 91 
unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the line called was a 


number listed on the register of numbers kept by the Commissioner in 


7 


25. 


26. 


27. 


28. 


29. 


ICO. 


Information Commissioner’s Office 


accordance with regulation 26, contrary to regulation 21(1)(b) of 
PECR; and 


The Commissioner is also satisfied for the purposes of regulation 21 
that these calls were made to subscribers who had registered with the 
TPS at least 28 days prior to receiving the calls and had not given their 


prior consent to House Guard to receive calls. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulation 21 by House Guard's activities over a 7 month period, and 
this led to a significant number of complaints about unsolicited direct 


marketing calls to the TPS and the Commissioner. 


In addition, it is reasonable to suppose that the contravention could 
have been far higher because those who went to the trouble to 
complain represent only a proportion of those who actually received 
calls. Between 8 May 2018 and 31 December 2018 House Guard 
indicated that it had conducted a direct marketing telephone campaign 
in respect of which they admit that approximately 669,966 were 
connected to subscribers. Of these calls 371,958 were made to TPS 
registered numbers, without conducting any due diligence on the data 


provided to them. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 
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Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. In the Commissioner's view, this means that 
House Guard's actions which constituted that contravention were 
deliberate actions (even if House Guard did not actually intend thereby 


to contravene PECR). 


The Commissioner considers that in this case House Guard did not 


deliberately contravene regulation 21 of PECR in that sense. 


The Commissioner has gone on to consider whether the contravention 


identified above was negligent. 


First, she has considered whether House Guard knew or ought 
reasonably to have known that there was a risk that this contravention 
would occur. She is satisfied that this condition is met, given that 
House Guard relied heavily on direct marketing due to the nature of its 
business, and the fact that the issue of unsolicited calls has been 


widely publicised by the media as being a problem. 


Each time a complaint is made to the TPS, the TPS inform the company 
complained about. House Guard would therefore have been aware that 
complaints were being made by TPS subscribers which should have 
prompted them to take steps to investigate the reasons for this and to 


address any deficiencies in their practices. 


The number of calls made to TPS registered individuals accounts for 
55% of the total call volume, this shows a disregard for the legislation 


Surrounding the making of marketing calls. House Guard purchased 
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data, without knowing how or where it was opted in, did not conduct 


due diligence on the data and did not screen it against the TPS. 


The Commissioner has also published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
subscribers who have told an organisation that they do not want to 
receive calls; or to any number registered with the TPS, unless the 


subscriber has specifically consented to receive calls. 


Finally, the Commissioner has gone on to consider whether House 
Guard failed to take reasonable steps to prevent the contravention. 


Again, she is satisfied that this condition is met. 


Reasonable steps in these circumstances would have included ensuring 
that House Guard had contractual agreements in place with its data 
providers, could evidence consents relied upon to make marketing calls 
and screening the data against the TPS register. Organisations buying 
marketing lists from third parties must make rigorous checks to satisfy 
themselves that the third party has obtained the personal data it is 
using fairly and lawfully, and that they have the necessary consent. It 
is not acceptable to rely on assurances of indirect consent without 
undertaking proper due diligence. Such due diligence might, for 


example, include the following: 


e How and when was consent obtained? 


e Who obtained it and in what context? 
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e Was the information provided clear and intelligible? How was it 


provided - e.g. behind a link, in a footnote, in a pop-up box, in a 


clear statement next to the opt-in box? 


e Did it specifically mention live calls, texts, e-mails or automated 
calls? 
e Did it list organisations by name, by description, or was the 


consent for disclosure to any third party? 


Organisations must ensure that consent was validly obtained, that it 
was reasonably recent and that it clearly extended to them specifically 


or to organisations fitting their description. 


Further, the Commissioner’s investigation revealed that the company’s 
largest data supplier went into liquidation approximately eighteen 
months prior to its data purchases. Had House Guard conducted even 
the most basic due diligence on this supplier they would have 
discovered this and alerted them to the fact that the data may not be 


as described. 


House Guard is unable to provide sufficient evidence that it had 
undertaken appropriate due diligence in this case. The Commissioner is 
therefore satisfied that House Guard failed to take reasonable steps to 


prevent the contravention. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner’s decision to issue a monetary penalty 


The Commissioner has taken into account the following 


aggravating features of this case: 
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e There has been deliberate action for financial or personal gain. 
The business was generating leads via marketing calls in order to 


create profit; 


e Advice and guidance has been ignored or not acted upon. This is 
published on the Commissioner’s website and is available via its 


advice services. 


e There appears to be clear evidence of obfuscation on the part of 
the directors of House Guard which, at times, frustrated the 


Commissioner’s investigation. 


e Despite the investigation into breaches of PECR, including receipt 
of an ‘end of investigation’ letter which informed House Guard 
that the Commissioner was considering exercising her regulatory 
powers in relation to the contravention, a further 127 complaints 


have since been received by the Commissioner and the TPS. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A(1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included issuing a Notice of Intent, in which the 


Commissioner set out her preliminary thinking. 


In reaching her final view, the Commissioner has considered 
representations received from House Guard on 27 November 2020. 
Nothing in those representations has persuaded the Commissioner to 


depart from her preliminary view. 
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The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 
should exercise her discretion so as to issue a monetary penalty in this 
case, and has decided that a monetary penalty is an appropriate and 
proportionate response to a finding of a serious contravention of 


regulation 21 by House Guard. 


The Commissioner has endeavoured to consider the likely impact of a 
monetary penalty on House Guard. House Guard were invited on 16 
December 2020 to provide updated evidence in support of the 
company’s current financial status, particularly in light of the ongoing 
pandemic. Despite a further request on 4 January 2021, House Guard 


has failed to provide the Commissioner with the requested evidence. 


The Commissioner's underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £150,000 (one hundred and fifty 


thousand pounds) is reasonable and proportionate given the 
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particular facts of the case and the underlying objective in imposing the 


penalty. 
Conclusion 


52. The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 12 March 2021 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


53. If the Commissioner receives full payment of the monetary penalty by 
11 March 2021 the Commissioner will reduce the monetary penalty by 
20% to £120,000 (One hundred and twenty thousand pounds). 
However, you should be aware that the early payment discount is not 


available if you decide to exercise your right of appeal. 


54. There is a right of appeal to the First-tier Tribunal (Information Rights) 
against: 


a) the imposition of the monetary penalty 
and/or; 


b) the amount of the penalty specified in the monetary penalty 
notice. 
55. Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 


56. Information about appeals is set out in Annex 1. 
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The Commissioner will not take action to enforce a monetary penalty 


unless: 


the period specified within the notice within which a monetary penalty 
must be paid has expired and all or any of the monetary penalty has 


not been paid; 


all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner 
as an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 9th day of February 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice or variation notice has been served a right 
of appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 
against the notice. 


2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 
accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her discretion 
differently, the Tribunal will allow the appeal or substitute such other 
decision as could have been made by the Commissioner. In any other 
case the Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 


GRC & GRP Tribunals 
PO Box 9300 
Arnhem House 

31 Waterloo Way 
Leicester 

LE1 8DJ 


a) The notice of appeal should be sent so it is received by the 
Tribunal within 28 days of the date of the notice. 


b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this rule. 
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The notice of appeal should state:- 


a) your name and address/name and address of your representative 
(if any); 


b) an address where documents may be sent or delivered to you; 
C) the name and address of the Information Commissioner; 

d) details of the decision to which the proceedings relate; 

e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 
monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the notice 
of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 


solicitor or another adviser. At the hearing of an appeal a party may conduct 
his case himself or may be represented by any person whom he may 
appoint for that purpose. 


6. 


The statutory provisions concerning appeals to the First-tier Tribunal 


(Information Rights) are contained in sections 48 and 49 of, and Schedule 6 
to, the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) 
(General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 
1976 (L.20)). 


